Privacy statement Sjees-app

This privacy statement provides information on how the Sjees-app handles personal data that is processed in the context of its functioning.

The Sjees-app has been developed by Mobidot B.V, who is also responsible for operating the app and the processing of all personal data (hereinafter referred to as: ”the Processor”) on behalf of Brainport Bereikbaar (hereinafter referred to as: ”Brainport Bereikbaar”). Brainport Bereikbaar is a partnership of the 21 municipalities in Southeast Brabant. Together with travellers, employers and educational institutions, Brainport Bereikbaar facilitates and stimulates smart mobility solutions in the Brainport region, including the use of bicycles.

The Processor cooperates with Keijzer B.V (hereinafter referred to as: ”the Sub-processor”) in its services for offering a support desk. Between the two organisations personal data can be shared for this purpose.

The municipality of Eindhoven acts as secretary for Brainport Bereikbaar. This means that the municipality of Eindhoven is the contact person for the partnership, both for third parties and for all participants within the partnership. The municipality of Eindhoven (hereinafter referred to as: “the Controller“) is the client for the development and operation of the Sjees-app and therefore the controller.

Contact details:
Sjees-app
support@sjees-app.nl

The Processor
Mobidot B.V.
Colosseum 44, 7521 PT Enschede
info@mobidot.nl

The Sub-processor
Keijzer B.V.
Maliebaan 108, 3581 CZ Utrecht

Brainport Bereikbaar
info@brainportbereikbaar.nl

Secretary of Brainport Bereikbaar and the Controller:
Municipality of Eindhoven
Stadhuisplein 1, 5611 EM Eindhoven
privacy@eindhoven.nl

Goal
The Sjees-app is part of the bicycle impulse initiative of Brainport Bereikbaar. With this app you gain insight into your daily cycling movements and you can save nice gifts and discounts with those cycling miles. The Sjees-app on the smartphone automatically registers where and when the bicycle is used in your daily travel and you as a user receive a reward for this. The Sjees-app is also used for fun challenges to make cycling even more challenging. Of course, coupled with attractive prices.

To achieve this goal, it is necessary to install the Sjees-app, create an account and allow the app to collect (detailed) data about, among other things, your movements by bicycle. We need this collected data to determine your movements and to award any associated rewards and, in the future, to make suitable traffic lights turn green more quickly for cyclists.

The data that the Processor collects and processes contains personal data. The data is collected to identify the user and the user shares this data with the Sjees-app to make optimal use of it. This privacy statement is an addition to the general privacy statement from the Sjees-app. In the event of any conflict between these or other conditions declared applicable, these conditions shall prevail.

The main points

1. We collect your movements (location data) to give you insight into your own travel behaviour and to reward you for the smart travel choice.
2. We automatically determine how and with what modality you move using the sensors of your phone. We also collect your feedback about your travel experience.
3. In order to identify you as an individual, you must create a user account in the Sjees-app. Your e-mail address is used as a unique username. You must also provide your zip code to check whether you meet the conditions for participation. (account and profile information).
4. Your personal movements and feedback will not be shared with third parties, unless you do this yourself via the sharing options in the Sjees-app.
5. We anonymize your travel data and feedback and provide it to Brainport Bereikbaar for mobility management policy. Furthermore, we make it available for (scientific) research. This information is not sold.
6. If you are cycling near a traffic light equipped for this purpose, you may be able to request green light automatically increasing the chance that you can continue cycling without waiting. This request is anonymous.
7. While using the Sjees-app, we collect log data, such as the smartphone model you use and the amount of data exchanged daily. These are used by us to improve and optimize the service.
8. If you contact the support desk, the contact details you specified (email, telephone number) will be used to provide an answer. It is possible that this data is kept by the support desk for training purposes or to improve the Sjees-app.
9. You always have control over the data you provide or the measured data. If you want your user account to be terminated, you can contact support@sjees-app.nl and all your personal data will be removed from our systems. If you are not active as a user for 24 months, all your data will be automatically removed from our systems.
10. You have the right to view all data recorded about you. If you believe that data has been recorded incorrectly, you can request to change it.
11. We have a complaints procedure. If you have a complaint or believe that we do not handle your data correctly, you can make this known via support@sjees-app.nl .

Full Privacy Statement
This privacy statement describes the guidelines for the information that the Processor or Sub-processor as well as the Controller (collectively “We”, “Us”) collect, process and store when you use the Sjees-app.

As providers of the Sjees-app, we think it is very important that users can rely on us. This means that we handle data and specifically personal data responsibly. The guidelines of this privacy regulation are in accordance with the General Data Protection Regulation (EU2016/679, hereinafter “GDPR”), and the guidelines of the Dutch Data Protection Authority.

The Municipality of Eindhoven, as secretary for Brainport Bereikbaar, is the client of the Sjees-app, and within the meaning of the law Responsible for the privacy-sensitive data processed via the Sjees-app (the Controller). The project is carried out by a project organization. Within this project organization, the company Mobidot B.V. is responsible for the development of the Sjees-app, the availability and the daily processing of the data used within the Sjees-app. This makes the processor within the meaning of the law Processor of the privacy-sensitive data processed via the Sjees-app. The Processor works closely together and shares information with the project partner and Sub-processor Keijzer B.V. for the purpose of running a support desk. To this end, the parties have signed a processing agreement with each other.

Collecting information
We collect your data on a voluntary basis through the use of the Sjees-app. By using the Sjees-app, you consent to the collection and processing of your personal data in accordance with this privacy statement. If you do not wish this, we request that you do not use the Sjees-app (and your account) or immediately stop using the Sjees-app and entrust that we delete your data in the manner stated in this privacy statement.

The Sjees-app is for personal use. You decide for yourself which data you want to provide to us and you are always in control of whether or not you give feedback and whether the Sjees-app should measure your movements.

The data that the Processor collects from you:
A. Account Information

• Collection purpose: to provide access to the Sjees-app. Filtering of appropriate challenges. Personalizing the Sjees-app.
• Data: first and last name, e-mail address, zip code residential address; interests (sustainability, travel time, health or cost aspect); setting preferences.

B. Contact details (only if you approach the support desk):

• Collection purpose: to provide support for specific questions or problems with the Sjees-app.
• Data: e-mail address and/or telephone number
• Sub-processor: Keijzer B.V.

C. Address data

• Collection purpose: to be able to send a reward such as an entrance ticket or other prizes by post.
• Data: postal address
• Sub-processor: Keijzer B.V.

D. Mobility data

• Collection purpose: to collect information on your travel behaviour and travel experience. Support issuance of rewards for displayed travel behaviour. To gain insight into travel behaviour and effects. To provide travel advice. To be able to show all your rides on a map, the Sjees-app needs permission to use your location. The Sjees-app uses location in the background to passively register rides, even when you are outside the Sjees-app, including at what time you start or stop moving.
• Core data: smartphone sensor (GPS, WiFi and Accelerometer) traces linked to times (“rides”), collected feedback on questions in the Sjees-app and via surveys on travel behaviour, motivation, demographics and travel experience.

E. Log data

• Collection purpose: to analyse and improve the performance and usage of the Sjees-app.
• Core data: usage data/analytical data of the Sjees-app and smartphone (type of smartphone, operating system and version, battery level, sensing events, log data on Sjees-app performance).

Processing information
If you use the Sjees-app, we collect your rides in a personal overview (“my mobility”). The information derived by us concerns:

• Start and end time of each ride;
• Start and end point, route and infrastructure used during each ride;
• Distance travelled, journey time and average speed;
• Means of transport for each ride;
• Purpose of the ride;
• Frequently visited places;
• Frequently chosen routes;
• Modal share;
• Weather conditions during the ride;
• Estimate of costs, CO2 savings and calories burned per ride;
• Any feedback given.

In addition, we ask for additional demographic background information, bicycle use in the past and motivation via the Sjees-app. With this information the effects of the Sjees-app are measured and evaluated.

The processing of data takes place in a well-secured data centre in the Netherlands. Only a limited group of designated administrators has access to the data processing systems and the data. This data is used by us to offer the Sjees-app to you, pursuant to the applicable terms of use. We will not change the goal in the meantime without your permission.

We do not knowingly process personal data of children under the age of 16. If it appears that we have collected personal data from someone under the age of 16 and no explicit permission has been given by parents or guardian, the subsequent account will be closed immediately and all personal data will be deleted.

We anonymize all your collected and processed travel data including the feedback you provide about travel experience by aggregating and randomizing it. After this, the data can no longer be traced back to you.

Anonymization is achieved by pooling information from multiple users and randomizing the information. Randomization includes:

• Cut away 0-200 meters at the start and end of measured routes;
• Removal of user information so that, for example, it can no longer be traced that the bicycle ride from A to B on Tuesday was carried out by the same person as the ride from C to D on Friday;
• Shift data in time with a randomly determined offset of random -30 and +30 minutes.

We use a number of reward partners to be able to make the Sjees-app valuable to you and to fulfil our obligations. These reward partners help us to provide rewards or additional services. These reward partners do not have access to your personal information or account.

Third party services from Google and Apple provide support services such as the availability of the Sjees-app in the app stores and the interaction of the Sjees-app with the iOS or Android operating systems on your phone, respectively. These services are not part of our privacy policy and you must separately agree to the terms of those parties.

Changes in the service
We may contract additional third parties to provide or expand the Sjees-app or to comply to our obligations, but will never provide your personal information to these third parties without your prior consent. These third parties will always be required to protect your personal data in accordance with this privacy statement.

In the event that any of the Processing parties is sold or transferred, or in the event that substantially all of the assets of any of the (sub-)Processor are sold or transferred to a third party, you will be notified in advance and you will have the right to account and have all your personal data deleted. In any case, the third party has the obligation to take over your rights with regard to your personal data as described in this privacy statement.

Retention of information
The municipality of Eindhoven does not store any personal data. The Processor only retains the personal data for as long as necessary for the purpose of the project and as determined by the municipality of Eindhoven, unless it is required by law to keep certain personal data longer. After the end of the project, all collected and derived personal data will be removed from the systems of the processor within 3 months.

Deletion of the Sjees account and associated data
If you want to terminate your Sjees account, you must indicate via support@sjees-app.nl that you no longer wish to use the Sjees-app. We will then close your account within ten working days and remove all your collected and derived personal data from our systems within four working weeks, unless we are required by law to retain certain data for longer. If the latter is the case, we will inform you of this.

Access to and change of your personal information
You always have control over your personal data. We offer you choices within the Sjees-app regarding the collection, use and sharing of your data. This choice may have consequences for the services, functionality and information that we can provide you. Via the Sjees-app you can almost completely view your travel behaviour and change, correct or revise presented ride data yourself.

You have the right to know what personal data has been recorded about you and with whom we share it. Do you want to view them? Send an email to support@sjees-app.nl . We will then provide you with this information within four working weeks. In this process we reserve the right to ask you to identify yourself. In addition, we can:

• change your personal data if you rightly indicate that they are not correct;
• delete your personal data (under conditions).

You can only view, change or delete your own personal data. You are not allowed to view data of other persons. An unreasonable number of requests from an individual may result in charges for this feature.

Providing and disclosing information
The anonymized mobility data and management reports are shared by the Processor with Brainport Bereikbaar with the aim of gaining statistical insight into travel movements at regional level in order to improve accessibility, monitor and evaluate current mobility management policies and stimulate sustainable transport.

Anonymised mobility data is also used for (scientific) research and for communication and promotion of the results and effects of the application of the Sjees-app to a wider audience.

We will never provide, distribute or disclose your personal information and non-anonymised mobility data to third parties unless we are required to do so to:

• to comply with legal regulations or case law;
• to prevent prohibited or illegal activities;
• take actions to protect the interests of you or other users;
• defend the rights or property of Brainport Bereikbaar, the municipality of Eindhoven, Mobidot or other third parties;
• to execute this privacy statement.

You are responsible for sharing or showing information that you obtain from the Sjees-app. We can never be responsible for the use, misuse, collection or disclosure of information outside of the Sjees-app.

The information collected is not transferred outside the European Union.

Security of the information
To protect your personal data, we have taken measures in accordance with Article 32 of the GDPR. We take administrative, process, technical and physical measures to protect personal data against misuse, as well as unauthorized access, disclosure, alteration and destruction. We perform a Data Protection Impact Assessment (DPIA) on a regular basis.

• All personal data is stored and processed in a reliable, well-secured data centre in the Netherlands with physical and logical access security including organizational control. the Processor uses data centre facilities of the Dutch company Previder (previder.nl). This data centre is ISO 27001, 14001 and 9001 certified. In the context of privacy and data protection, the Processor (Mobidot) has concluded appropriate contracts with Previder.
• Logical and physical access control to the ICT systems. The Processor has digitally secured its system environment with a hardware firewall and monitors its system environment for unauthorized access and intrusion. We will take all reasonable steps to prevent unauthorized physical and digital access to our system environments and data by unauthorized persons. We do this, among other things, by equipping our system environments with recent operating systems and the latest (security) patches, which are recommended and supported by the suppliers for use in our system environments. Related to reliable use of the software used, we also strive for the optimal combination of all software components used.
• The communication between apps, data processing infrastructure and websites takes place via secure connections.
• We are committed to processing your personal data properly and carefully. We guarantee that our staff and anyone else engaged by us will comply with the provisions of the GDPR, or the provisions of the Exemption Decree and the provisions of the municipality of Eindhoven, if and insofar as they are involved in any way in the processing of personal data. Management of our system environments is carried out and monitored by authorized administrators employed by the companies involved, bound by an integrity contract and non-disclosure agreement.
• Only a limited group of administrators designated for this purpose within the project organization has access to the system environment. These administrators, who are authorized by administrators of the Processor, are allowed to change certain settings, implement changes and/or generate certain statistical overviews within the Sjees-app. Each of them receives their own unique user ID and associated password.
• Data leaks are proactively reported by us to the Controller.
• Security incidents can be reported at any time to support@sjees-app.nl.

Questions or complaints about privacy
If you believe that the use of your personal information is inconsistent with the purpose for which you provided it to us, as described in this privacy statement, or if you have any questions or suggestions regarding this privacy statement, you may contact us at support@sjees-app.nl. If desired, you can also contact us via privacy@eindhoven.nl.

If you believe that we are not handling your complaint correctly, you can always use your right to submit a complaint to the Dutch Data Protection Authority or to appeal to a competent court.

The systems of the Processor have been put together as carefully as possible and follow the current safety requirements. However, there may be a vulnerability that is not yet known to us. We ask users, researchers or ethical hackers to help prevent abuse and increase the security of our ICT systems. If a security problem is encountered on the systems of Mobidot or unsecured information is found, please report this first and only via privacy@mobidot.nl. We will keep the reporter informed about the handling of the report.

Changes to the privacy statement
We reserve the right to change this privacy statement from time to time. We do not limit your rights under this privacy statement without your consent. This also means that the rules for existing data cannot be changed and an amended privacy statement only applies to newly collected data. We will post changes to this privacy statement on this website and, if the changes are significant, we will provide a more prominent notice to you.

Contact
Do you have questions after reading this privacy statement? Or do you have questions about how we handle your personal data? Please feel free to contact us:

• Mobidot B.V. (the Processor): support@sjees-app.nl
• Municipality of Eindhoven (the Controller): privacy@eindhoven.nl

Do you have questions about the application and compliance with privacy legislation? Or do you have a complaint about the way in which the municipality of Eindhoven handles your personal data? Please feel free to contact the Data Protection Officer via fg@eindhoven.nl .

Last modified: March 15, 2023